CVE-2026-22252: LibreChat MCP Stdio Unvalidated Command Execution
CVE-2026-22252 affects LibreChat's MCP stdio transport, which accepts arbitrary commands without validation according to the record. The description states that an authenticated user may run shell commands as root inside the container, and the issue is fixed in v0.8.2-rc2. The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.
Overview
LibreChat is a ChatGPT-style application with extra features. According to the record, versions before v0.8.2-rc2 pass commands to the MCP stdio transport without validation. The record classifies the weakness as CWE-285 (Improper Authorization).
Impact
The record states that any authenticated user may execute shell commands as root inside the container through a single API request. NVD assigns a score of 9.9 and GitHub assigns 9.1, both rated critical. The vector in the record indicates high impact on confidentiality, integrity and availability, with a scope change.
Affected products and versions
- Danny-avila/librechat: versions before v0.8.2-rc2.
- Librechat Librechat: version 0.8.2-rc1.
The record lists the second entry as a single version and does not explain whether other builds are affected.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so active exploitation cannot be confirmed from that source. No confirmed exploitation appears in the sources consulted. The SSVC data marks exploitation as 'poc' (proof of concept), and one reference is tagged 'Exploit'. These details do not confirm exploitation in the wild.
Remediation and mitigation
- Upgrade LibreChat to v0.8.2-rc2 or later, as described in the GitHub advisory.
- Review the fix commit to understand the change.
- Limit which accounts can create or modify MCP server configurations, as a temporary measure until upgrading (inference).
- Reduce container privileges where possible, so a compromised process has less reach (inference).
Detection guidance
- Review audit logs for MCP server configurations created or changed by non-administrative users.
- Monitor the LibreChat container for unexpected child processes started by the application service.
- Maintain an inventory of LibreChat builds to find deployments below v0.8.2-rc2.
Limitations of the available information
The record does not describe the exact configuration needed to reach the vulnerable transport, nor whether default deployments are exposed. The list of affected builds is taken directly from the record and may be incomplete. The EPSS value is 0.04223 and should be read as a probability estimate, not as evidence of exploitation.
Frequently asked questions
What is CVE-2026-22252?
It is a vulnerability in LibreChat's MCP stdio transport that, according to the record, accepts arbitrary commands without validation before version v0.8.2-rc2.
Which versions are fixed?
The record says the issue is fixed in v0.8.2-rc2. Versions before v0.8.2-rc2 are listed as affected, and the record also lists version 0.8.2-rc1.
Is this vulnerability being actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.